Search message tracking logs

Message tracking records the message activity as mail flows through the transport pipeline on Mailbox servers and Edge Transport servers. You can use the Get-MessageTrackingLog cmdlet in the Exchange Management Shell to search for entries in the message tracking log by using specific search criteria. For example:

• Find out what happened to a message that was sent by a user to a specific recipient.
• Find out if a transport rule acted on a message.
• Find out if a message sent from an Internet sender made it into your Exchange organization.
• Find all messages sent by a specified user during a specified time period.

This example searches the message tracking logs on the local server for all entries from 2/20/2018 8:00 AM to 2/20/2015 5:00 PM for all FAIL events where the message sender was sender@mutega.se

Get-MessageTrackingLog -ResultSize Unlimited -Start ”2/20/2018 8:00AM” -End ”2/20/2018 5:00PM” -EventId ”Fail” -Sender ”sender@mutega.se”

This example searches the message tracking logs on the local server for all entries from 2/20/2018 8:00 AM to 2/20/2015 5:00 PM for all emails sent to to@mutega.com where the message sender was sender@mutega.se

Get-MessageTrackingLog -ResultSize Unlimited -Start ”2/20/2018 8:00AM” -End ”2/20/2018 5:00PM” -EventId ”Fail” -Sender ”sender@mutega.se” -Recipients ”to@mutega.com”

More info (Source article): https://technet.microsoft.com/en-us/library/bb124926%28v=exchg.160%29.aspx?f=255&MSPPError=-2147217396